{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: TP-Link vulnerabilities","home_page_url":"https://patchfirst.co/vendor/tp-link/","feed_url":"https://patchfirst.co/feed/vendor/tp-link.json","description":"New and newly exploited TP-Link CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-9377#kev","url":"https://patchfirst.co/cve/CVE-2025-9377/","title":"[KEV] CVE-2025-9377: TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability","content_text":"TP-Link · Multiple Routers. In CISA KEV since 2025-09-03. ENISA EUVD lists it as exploited. EPSS 41.3% (higher than 98.7% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 62.8 of 100.","summary":"TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability","date_published":"2025-09-03T00:00:00.000Z","date_modified":"2026-10-18T21:10:00.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":62.8,"kev":{"dateAdded":"2025-09-03","ransomware":false},"epss":{"score":0.413,"percentile":0.98667},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"TP-Link","product":"Multiple Routers","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-50224#kev","url":"https://patchfirst.co/cve/CVE-2023-50224/","title":"[KEV] CVE-2023-50224: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability","content_text":"TP-Link · TL-WR841N. In CISA KEV since 2025-09-03. ENISA EUVD lists it as exploited. EPSS 20.0% (higher than 97.4% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 62.0 of 100.","summary":"TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability","date_published":"2025-09-03T00:00:00.000Z","date_modified":"2026-09-03T17:28:42.000Z","tags":["kev","T1190","T1552"],"_patchfirst":{"reason":"kev","priority":62,"kev":{"dateAdded":"2025-09-03","ransomware":false},"epss":{"score":0.20021,"percentile":0.97436},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"TP-Link","product":"TL-WR841N","techniqueIds":["T1190","T1552"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-24363#kev","url":"https://patchfirst.co/cve/CVE-2020-24363/","title":"[KEV] CVE-2020-24363: TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability","content_text":"TP-Link · TL-WA855RE. In CISA KEV since 2025-09-02. ENISA EUVD lists it as exploited. EPSS 22.2% (higher than 97.7% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation. Priority 68.7 of 100.","summary":"TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability","date_published":"2025-09-02T00:00:00.000Z","date_modified":"2026-06-17T03:05:25.000Z","tags":["kev","public-exploit","T1190","T1098"],"_patchfirst":{"reason":"kev","priority":68.7,"kev":{"dateAdded":"2025-09-02","ransomware":false},"epss":{"score":0.22187,"percentile":0.97672},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"TP-Link","product":"TL-WA855RE","techniqueIds":["T1190","T1098"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-33538#kev","url":"https://patchfirst.co/cve/CVE-2023-33538/","title":"[KEV] CVE-2023-33538: TP-Link Multiple Routers Command Injection Vulnerability","content_text":"TP-Link · Multiple Routers. In CISA KEV since 2025-06-16. ENISA EUVD lists it as exploited. EPSS 41.6% (higher than 98.7% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 68.9 of 100.","summary":"TP-Link Multiple Routers Command Injection Vulnerability","date_published":"2025-06-16T00:00:00.000Z","date_modified":"2026-06-17T06:01:53.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2025-06-16","ransomware":false},"epss":{"score":0.41606,"percentile":0.9868},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"TP-Link","product":"Multiple Routers","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-21833","url":"https://patchfirst.co/cve/CVE-2024-21833/","title":"CVE-2024-21833: Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute…","content_text":"TP-Link · Archer AX3000. Not in CISA KEV. EPSS 1.1% (higher than 64.6% of CVEs). CVSS 8.8 HIGH. Priority 59.1 of 100.","summary":"Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute…","date_published":"2024-01-10T00:00:00.000Z","date_modified":"2025-06-16T18:26:24.000Z","tags":[],"_patchfirst":{"reason":"published","priority":59.1,"kev":null,"epss":{"score":0.01063,"percentile":0.64623},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"TP-Link","product":"Archer AX3000","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-1389#kev","url":"https://patchfirst.co/cve/CVE-2023-1389/","title":"[KEV] CVE-2023-1389: TP-Link Archer AX-21 Command Injection Vulnerability","content_text":"TP-Link · Archer AX21. In CISA KEV since 2023-05-01. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1106 Native API; T1496 Resource Hijacking; T1041 Exfiltration Over C2 Channel; T1070 Indicator Removal; T1498 Network Denial of Service. Priority 69.2 of 100.","summary":"TP-Link Archer AX-21 Command Injection Vulnerability","date_published":"2023-05-01T00:00:00.000Z","date_modified":"2026-06-17T05:27:50.000Z","tags":["kev","public-exploit","T1106","T1496","T1041","T1070","T1498"],"_patchfirst":{"reason":"kev","priority":69.2,"kev":{"dateAdded":"2023-05-01","ransomware":false},"epss":{"score":0.99999,"percentile":0.99992},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"TP-Link","product":"Archer AX21","techniqueIds":["T1106","T1496","T1041","T1070","T1498"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-3035#kev","url":"https://patchfirst.co/cve/CVE-2015-3035/","title":"[KEV] CVE-2015-3035: TP-Link Multiple Archer Devices Directory Traversal Vulnerability","content_text":"TP-Link · Multiple Archer Devices. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 83.9% (higher than 99.69% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"TP-Link Multiple Archer Devices Directory Traversal Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T00:25:09.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.83948,"percentile":0.99692},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"TP-Link","product":"Multiple Archer Devices","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-4045","url":"https://patchfirst.co/cve/CVE-2021-4045/","title":"CVE-2021-4045: TP-LINK Tapo C200 remote code execution vulnerability","content_text":"TP-Link · Tapo C200. Not in CISA KEV. EPSS 72.4% (higher than 99.44% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 69.0 of 100.","summary":"TP-LINK Tapo C200 remote code execution vulnerability","date_published":"2022-03-07T00:00:00.000Z","date_modified":"2024-09-17T02:57:31.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":69,"kev":null,"epss":{"score":0.72376,"percentile":0.99438},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"TP-Link","product":"Tapo C200","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}